{"id":"CVE-2026-98854","kind":"vulnerability","aliases":["CVE-2026-98854"],"related":[],"title":"Linux kernel: device tree overlay error path can dereference NULL","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nof/overlay: only treat a positive changeset id as registered\n\nof_overlay_fdt_apply() stores the idr_alloc() return value in\novcs->id before checking it. On failure the stored id is negative,\nfree_overlay_changeset()'s \"if (ovcs->id)\" check passes, idr_remove()\nis called with a negative id and list_del() runs on ovcs->ovcs_list,\nwhich is not initialized until after the id allocation. An allocation\nfailure at that point dereferences NULL.\n\nMake free_overlay_changeset() treat only a strict-positive id as\nregistered. The rest of the function already copes with a\npartially-initialized ovcs, so the error path stays a plain\ngoto err_free_ovcs.","summary":"When applying a device tree overlay fails during ID allocation, the kernel's cleanup path treats a negative ID as valid and calls list operations on an uninitialized list, which dereferences NULL. The sources describe a kernel crash from this bug; they do not state that an attacker can trigger it or gain control.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["arm","embedded","infrastructure","linux-kernel"],"not_affected_if":["no-device-tree-overlays"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown from these sources)\n- Check whether the device tree overlay subsystem is in use with `ls /sys/kernel/config/device-tree/overlays` (unknown if this path is used)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'of/overlay: only treat a positive changeset id as registered' (fixed version unknown from these sources)","status":"open","published_at":"2026-10-18T16:17:39+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","triaged_at":"2026-10-25T05:13:01+00:00","updated_at":"2026-10-25T05:13:01+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:13:01Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'of/overlay: only treat a positive changeset id as registered' (fixed version unknown from these sources)","reach":"local","title":"Linux kernel: device tree overlay error path can dereference NULL","impact":"medium","summary":"When applying a device tree overlay fails during ID allocation, the kernel's cleanup path treats a negative ID as valid and calls list operations on an uninitialized list, which dereferences NULL. The sources describe a kernel crash from this bug; they do not state that an attacker can trigger it or gain control.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","embedded","arm"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel NULL dereference causing a crash, possibly worse","analyst_note":"Check the NVD entry and the upstream kernel commit for the fixed version and whether the trigger needs privileges.","how_to_check":"- Run `uname -r` and compare against the fixed kernel version in your distribution's advisory (unknown from these sources)\n- Check whether the device tree overlay subsystem is in use with `ls /sys/kernel/config/device-tree/overlays` (unknown if this path is used)","needs_analyst":true,"not_affected_if":["no-device-tree-overlays"],"who_is_affected":"Only systems that load device tree overlays through the of/overlay code path are exposed, typically embedded or ARM boards with runtime device tree configuration. Servers and desktops that never apply device tree overlays can likely skip it. Whether an unprivileged user can trigger the allocation failure is unknown from these sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000655,"input_tokens":3470,"output_tokens":616,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':12A,15A '-98854':13A,16A 'alloc':32B,103C,152C,154C 'alreadi':179C 'appli':24B,99C 'arm':17B 'attack':70B 'bug':63B 'call':45B,131C 'changeset':92C,121C,164C 'check':110C,126C 'cleanup':36B 'control':76B 'cope':180C 'crash':60B 'cve':11A,14A 'del':138C 'derefer':9A,53B,159C 'describ':57B 'devic':3A,26B 'embed':18B 'err':195C 'error':6A,189C 'fail':29B 'failur':113C,155C 'fdt':98C 'follow':82C 'free':119C,162C,196C 'function':178C 'gain':75B 'goto':194C 'id':31B,41B,93C,108C,116C,125C,135C,151C,171C 'idr':102C,128C 'infrastructur':19B 'initi':147C,185C 'kernel':2A,22B,34B,59B,80C 'linux':1A,21B,79C 'linux-kernel':20B 'list':46B,51B,137C,143C 'make':161C 'negat':40B,118C,134C 'null':10A,54B,160C 'of/overlay':87C 'oper':47B 'ovc':107C,124C,141C,142C,186C,197C 'overlay':5A,28B,97C,120C,163C 'partial':184C 'partially-initi':183C 'pass':127C 'path':7A,37B,190C 'plain':193C 'point':158C 'posit':91C,170C 'regist':95C,173C 'remov':129C 'resolv':86C 'rest':175C 'return':104C 'run':139C 'sourc':56B 'state':67B 'stay':191C 'store':100C,115C 'strict':169C 'strict-posit':168C 'treat':38B,89C,165C 'tree':4A,27B 'trigger':72B 'uniniti':50B 'valid':43B 'valu':105C 'vulner':83C","nicknames":[],"mitigations":[],"who_affected":"Only systems that load device tree overlays through the of/overlay code path are exposed, typically embedded or ARM boards with runtime device tree configuration. Servers and desktops that never apply device tree overlays can likely skip it. Whether an unprivileged user can trigger the allocation failure is unknown from these sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:39+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98854","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98854","severity":null,"published_at":"2026-10-18T16:17:39+00:00","modified_at":"2026-10-21T13:21:49+00:00","first_seen_at":"2026-10-23T21:57:17+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}